High capacity, transmission based signalling for London's Underground G.E. Clark London Underground Limited, Telstar House, Eastbourne

Transcription

1 High capacity, transmission based signalling for London's Underground G.E. Clark London Underground Limited, Telstar House, Eastbourne Abstract In recent years the high passenger demand levels on metres has stretched the existing 'conventional fixed block' signalling systems to their limits and has led the signalling engineer to radically re-think his total system. The developments in transmission systems, particularly radio, coupled with the expanding use of more complex vital processing techniques has enabled new systems to be considered to replace the existing method of safely authorising a train to proceed. The processor intensive nature of these systems require the development of an assurance culture which addresses the whole system life-cycle and gives the level of confidence in the software integrity appropriate to the criticality of the signalling system. History In the mid 1980's, passenger demand was higher than ever experienced by London Underground and some lines were no longer able to consistently achieve the service timetable required. Both trains and platforms became severely overcrowded and this inevitably led to a very low level of customer satisfaction. Studies carried out into methods of improving the service highlighted the capacity limitations of the traditional signalling systems. The capacity of the signalling system is termed 'headway'. This is the minimum time between two trains, travelling at maximum speed, which includes an allowance for the platform dwell time in station areas. This allowance can become inadequate when demand changes, as in the 1980s, and will increase the headway. Other factors such as the reduced speed of the heavily loaded trains could not be used by the conventional signalling system to increase throughput, without modification. Although a number of schemes were developed to improve capacity at given 'pinch points', it

2 206 Railway Operations was clear that a radical re-think of our signalling system for areas of high traffic density was required. Modernisation The heavily used Central and Northern lines on the Underground were planned in the 1980s for renewal of their systems and infrastructure. Both lines required a signalling system incorporating continuous Automatic Train Protection and Automatic driving for a safe and consistent maximisation of the signalled headway. World-wide studies into high capacity systems were undertaken which identified a number of possible systems in varying stages of development. Although the requirements of the Central line were met by a fixed block system, the more complex Northern Line required a 36 trains per hour service capacity to meet its predicted passenger demand. In-depth studies into transmission-based high capacity systems capable of meeting this demand were carried out which highlighted both benefits and disbenefits. However, the lower passenger levels and limited capital finance during the UK recession has resulted in the Jubilee Line Extension project making first use of this experience. Transmission Based Signalling (TBS) TBS is a signalling system in which the safe distance between trains is achieved by the continuous transmission of high resolution positional data from trains to a control processor where it is converted into target points for following trains. Data received from the control processor is used by the trains to enforce a dynamic safety distance (Figure 1b). It differs in two key respects from the traditional system shown in figure Train location is given by the On-board Processor (OBP). The use of the bi-directional radio link, via the Train Control Processor, provides train location data to the following train. The train OBP continuously calculates its safety distance, based upon its own speed. These systems are often described as 'moving block' but this term can often mislead as the system, although not as rigid as traditional signalling, still retains some constraints on its block length linked to the tolerances and resolution of the train-borne system sensors. The TBS system enables trains to travel as close as safely possible, given the speed of the following train. When as the speed reduces the safe distance between the trains, based upon the braking ability of the following train, can be reduced also. Hence as trains progress along the line their distance of safety is not that fixed by the expected highest

3 Railway Operations 207 Transactions on the Built Environment vol 7, 1994 WIT Press, ISSN train speed at a given point nor by the set resolution of a traditional train detection system. These factors lead to maximisation of the throughput of a given section of line under changing service conditions. TBS provides more than just high capacity and for LUL the bonus of such systems include: Virtually no trackside equipment (signals, track circuits etc..) Especially important in tunnels; increasing maintainability. Line capacity is not fixed at design but can be controlled to meet demand. The system can be overlaid on an existing signalling system, allowing dual running of trains and minimal disruption during installation and commissioning. The train service can recover quickly after a delay as the trains can be 'closed up'. Bi-directional signalling can be achieved at little cost. Transmission based signalling benefits do have a cost, the dis-benefits are perceived as: The loss of the Train Control Processor (TCP) can have a high impact. All trains in its area would need to drive manually on sight, with no ATP, increasing the safety risk to passengers and staff, and causing significant delays to the train service. The radio system coverage must be continuous. The occasional fading of voice radio in a harsh environment would not be acceptable for this system. A service recovery strategy is required following a TCP failure to guard against the potential loss of an unregistered (either nonequipped or defective on-board equipment) train by the system during start-up. The extensive use of safety critical software systems requires a considerable change in approach to safety assurance. It is important to recognise that to unleash the power of TBS requires a Line Control System (LCS) as well as modern trains with modern traction control systems. It is vital that the LCS and TBS operate in an integrated way. The LCS can apply service regulation strategies most effectively through the flexibility of TBS, maximising the service provided in a variety of ways. e.g. even train intervals, minimum journey time, or minimum power usage for a defined journey time. The TBS system also needs the LCS to ensure that a service delay does not result in all trains held 'cab to cab' in rear of the incident. It is therefore important to see the TBS system as part of an integrated service control system. (Goddard & Mellitt [1])

4 208 Railway Operations Safety Software Assurance The application of processor-based systems to meet safety critical railway requirements has been in evidence in the UK since the introduction of Solid State Interlockings in the late 1970s (Short [2]). However, the assurance techniques available are wide, varied and continually increasing as the demand for assurance of software and system integrity rises. LUL have been party to the preparation of the Railway Industries Association software specification (RIA 23)[4], currently in draft, and will apply this approach to the software used in its TBS systems. This specification is aimed at addressing the requirements of the draft European Standard, IEC 65A Secretariat 122[5]. It describes the software system life-cycle (See figure 2) and defines several key issues, linked to each phase: The documentation required. The techniques to be applied and those which should not. The roles, responsibility and level of independence of the design, verification, validation and assessment teams. These vary depending upon the integrity of the software system to be provided. Integrity levels exist from level 0, corresponding to nonsafety, up to a level of 4, for multiple life threatening. Hence, it is important to carry out risk assessment at the beginning of a TBS development to identify the integrity levels of the various software systems and to maintain the assessments throughout the software lifecycle. LUL approach such software systems in two stages. The first stage requires an assessment of the system in isolation from its application. A review of the processes used during development and their compliance with the RIA 023 model will be carried out and any safety issues related to its application, particularly in interfacing with other systems will be highlighted. The second stage would be validation and assessment of the application of the software system to the railway. Again the RIA023 model is used and agreement sought from the UK Governments' Railway Inspectorate upon presentation of the safety case for the use of the new signalling equipment or system. The Jubilee Line Opportunity As stated earlier, the application of the knowledge and strategies developed by LUL engineers for TBS systems has not been through the need to enhance capacity on an overcrowded line but to meet the predicted needs of a line extension through the old dockyards of

5 Railway Operations 209 HEADWAY H-H- BRAKING CURVE BRAKE ACTIVATION DEUKY Figure 1(a) - Traditional Sianallina Svstem Figure 1 (b) - Transmission Based High Capacity Svstem INITIAL CONCEPT REQUIREMENTS DEFINITION & ANALYSIS '. HAZARD ANALYSIS! SYSTEM REQUIREMENTS DEFINITION : DESIGNATION OF SAFETY RELATED SYSTEMS : OVERALL SYSTEM DESIGN! SOFTWARE REQUIREMENTS DEFINITION SOFTWARE ARCHITECTURAL DESIGN : SOFTWARE DETAILED DESIGN SOFTWARE CODE & TEST i SOFTWARE INTEGRATION & TEST! SYSTEM INTEGRATION & TEST REPEAT LIFECYCLE FOR MODIFICATIONS i FACTORY ACCEPTANCE TESTING : : SYSTEM INSTALLATION & COMMISSIONING \ : SITE ACCEPTANCE TESTING! i SYSTEM APPROVAL & CERTIFICATION MONITORING IAINTENANCE & J -4 SYSTEM OPERATION & MAINTENANCE DECOMMISSIONING FIG 2: SYSTEM LIFECYCLE

6 210 Railway Operations London. Aiding the redevelopment of these areas into large commercial centres, with potentially 150,000 jobs, which far exceeds the capacity of the local transport systems. The Jubilee Line Extension (JLE) (figure 3) passes through many major interchanges and its links will draw passengers from both east and west of London. Passenger demand predictions are very high and a need to provide a system which is capable of consistently delivering 36 trains per hour into platforms with long station dwells was identified early on. Jubilee Line Transmission Based Signalling An overview of the JLE systems design proposals has previously been published[3] and will not been repeated here. However, it is important to note the approach taken to overcome the dis-benefits of TBS mentioned earlier and the high degree of system integration required by a modern metro using a TBS system. TBS is particularly suited to the JLE since the signalling on the existing line has not yet reached half its design life and parts of the line are used by other train services. Hence a new system overlaid on the existing maximises the benefits and minimises disruption. The approach taken to safety assurance by the project is consistent with the current LUL approach described earlier. The availability issues were considered in relation to their service impact and the need for the overall signalling system to meet a requirement of 480 hours between delays greater than 10 minutes. Quality of service was deemed to be poor if a such a delay occurred. The knowledge of TBS-type systems, and the need for high availability throughout the life of these systems, led to two key requirements to be specifically highlighted. Firstly, a single sub-system failure must not cause a service delay, and secondly, the impact of a failure should be localised, consistent with that achieved with existing signalling design. These requirements were met by specifying redundancy in all sub-systems, or by the provision of a secondary, back-up signalling system and limiting the affect of a failure to a maximum of 1 kilometre. Systems Approach The high capacity railway to be realised as the extension to the Jubilee Line, will use its TBS system as part of the highly integrated railway control system, both at Line and Station Levels to move its passengers efficiently from the point they enter a station and purchase a ticket through to their destination. (See figure 4)

7 Railway Operations 21 FIG 3: THE EXTENDED JUBILEE LINE UNE CONTFIOL TRAIN RADIO. TELEPHONES. y/ I I MULTI-PURPOSE TUNNEL VENT. ^ POWER CONTROL JPL Q ^ OMMUNICATKDNS H ' OPERATOR & SCAD A CONTROL * [ VVORKSTATIONS PASSENGER INFORMATION s I DISPLAYS.(PIDS) 0ONTROL GNALLING PUBLIC ADDRESS.(PA) // tit i i i ^TOLOCAL NON- VITAL PROCESSORS CCTV. STATION CONTROl y TO CONTROL CENTRE \ TO CONTR OLCENFTR LNP ^ " TO si T ^^ ^ NEIGHBOUR TICKET GATES"! S FIRE ALARMS. ~* ^ ^ TCP ^-^ ESCALATORS. ' ^ \SIGN; PIDS. INTEF,LOCK,NG-«\ +) _z:zzi"- CCTV. I I \ K - PA. ) N\ TRACKS! DE^ SIGNALS... \ PLATFORM EDGE DOORS \ n^aiic pogc_ jj^ip / / Illl *^#p***#w CLOSED CIRCUIT T.V. /^5c ( ztzczz2l 2ZZZz> ^^ ^ *" 1 MC 2 Ao AUTOMATIC TRAIN DRIVING DATA COMPUTED FIGURE 4 - JUBlLEE LINE EXTENSION SYSTEMS OVERVIEW

8 212 Railway Operations The Line Control System will determine the regulation strategies that will be implemented through the TBS system, as well as allowing graceful degradation to control from the Station Information and Management System (SIMS), if needed. The TBS system must also facilitate the controlled evacuation of passengers in the event of an incident. Evacuation points are identified as either station platforms or specially equipped ventilation shafts between them. The facility to bidirectionally signal sections of the line is also applied to provide a service in at least one tunnel if possible. Hence, it is important to see that the TBS system not only provides a high capacity signalling system but can, through a highly integrated systems approach, facilitate many emergency measures, adding to the safety of passengers and the security of the train service. Conclusion The TBS systems, for which LUL strive, can provide significant improvements in line capacity compared to conventional, fixed block, systems whilst reducing the amount of equipment required, especially in tunnels, through the application of the latest technology in both processor and communications systems. These systems must be developed using the latest standards in safety assurance to demonstrate to LUL their correctness at a level consistent with their criticality. They must also be designed for high availability and maintainability throughout their design life. However, TBS systems must not be seen in isolation, they form part of a total system, including the rolling stock traction control, station management and Line Control systems, which together can provide the high capacity, flexible, and reliable railway to meet the needs of the next century and enable LUL to continue to provide a customer service of high quality, safely. References 1. Goddard E.G. & Mellitt B "Towards the Metro Control System of the 21st Century" IRSE, February Short, R.C. "The Integrity of Computing in the Design of Safety Railways." IMechE Railway Engineers Forum, November Jubilee Line Supplement, New Civil Engineer, February BRB/LU Ltd/RIA Specification No Safety Related Software in Railway Signalling 5. International Electro-Technical Committee 65A Secretariat 122, Draft document 'Software for Computers in the Application of Industrial Safety-related Systems'